found this while debugging a regression (crash) introduced by my fix for issue
107672:

calling setPropertyValue() on a SwXDocumentIndex deletes the existing mark and
then inserts a modified mark.
unfortunately the deletion will cause Invalidate to be called, which notifies
the listeners that the instance is disposed, which it actually is not.
also, Invalidate un-registers at the SwTOXType, which is probably also bad.

=>[1] SwEventListenerContainer::Disposing(this = 0x88c446c), line 106 in
"unoevtlstnr.cxx"
  [2] SwXDocumentIndexMark::Impl::Invalidate(this = 0x88c4450), line 1668 in
"unoidx.cxx"
  [3] SwXDocumentIndexMark::Impl::Modify(this = 0x88c4450, pOld = 0xefe0d02c,
pNew = 0xefe0d02c), line 1682 in "unoidx.cxx"
  [4] SwModify::Modify(this = 0x88c4acc, pOldValue = 0xefe0d02c, pNewValue =
0xefe0d02c), line 241 in "calbck.cxx"
  [5] SwTOXMark::Modify(this = 0x88c4ac0, pOld = 0xefe0d02c, pNew = 0xefe0d02c),
line 236 in "tox.cxx"
  [6] SwTOXMark::InvalidateTOXMark(this = 0x88c4ac0), line 248 in "tox.cxx"
  [7] SwTxtNode::DestroyAttr(this = 0xf20c315c, pAttr = 0x8994198), line 1174 in
"thints.cxx"
  [8] SwTxtNode::EraseText(this = 0xf20c315c, rIdx = CLASS, nCount = 1U, nMode =
INS_DEFAULT), line 2301 in "ndtxt.cxx"
  [9] SwTxtNode::DeleteAttribute(this = 0xf20c315c, pAttr = 0x8994198), line
1512 in "thints.cxx"
  [10] SwDoc::DeleteTOXMark(this = 0x88b2600, pTOXMark = 0x88c4ac0), line 204 in
"doctxm.cxx"
  [11] SwXDocumentIndexMark::Impl::DeleteTOXMark(this = 0x88c4450), line 1641 in
"unoidx.cxx"
  [12] SwXDocumentIndexMark::setPropertyValue(this = 0xefecc280, rPropertyName =
CLASS, rValue = CLASS), line 2279 in "unoidx.cxx"